EP2801874B1 - Mehrfachkanalsteuerungs-Umschaltlogik - Google Patents

Mehrfachkanalsteuerungs-Umschaltlogik Download PDF

Info

Publication number
EP2801874B1
EP2801874B1 EP14165781.7A EP14165781A EP2801874B1 EP 2801874 B1 EP2801874 B1 EP 2801874B1 EP 14165781 A EP14165781 A EP 14165781A EP 2801874 B1 EP2801874 B1 EP 2801874B1
Authority
EP
European Patent Office
Prior art keywords
control
microprocessor
channel
primary
action
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP14165781.7A
Other languages
English (en)
French (fr)
Other versions
EP2801874A1 (de
Inventor
Jeffry K. Kamenetz
James A. Gosse
Joseph T. Gostkowski
Richard L. Bue
Mark A. Johnston
James Peter Wivell
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hamilton Sundstrand Corp
Original Assignee
Hamilton Sundstrand Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hamilton Sundstrand Corp filed Critical Hamilton Sundstrand Corp
Publication of EP2801874A1 publication Critical patent/EP2801874A1/de
Application granted granted Critical
Publication of EP2801874B1 publication Critical patent/EP2801874B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B15/00—Systems controlled by a computer
    • G05B15/02—Systems controlled by a computer electric
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
    • G05B19/0421—Multiprocessor system
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00—Program-control systems
    • G05B2219/10—Plc systems
    • G05B2219/14—Plc safety
    • G05B2219/14014—Redundant processors and I-O
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B9/00—Safety arrangements
    • G05B9/02—Safety arrangements electric
    • G05B9/03—Safety arrangements electric with multiple-channel loop, i.e. redundant control systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
    • G06F11/202—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant

Definitions

  • the present disclosure relates to electrical controllers, and more particularly to an electronic control architecture integrating multiple control channels.
  • Existing electronic control systems typically utilize multi-channel primary controllers, and a back-up controller to control a device. Under normal fault-free conditions, the primary control controls the plant. The back-up controller assumes control when the primary controllers experience some threshold degree of damage or error that the primary controllers cannot recover from. For example, when both channels have a failure of their primary controllers. Another example is a channel-wide failure such as power supply failure in one channel simultaneous with the other channel's primary controller failing.
  • EP 2573636 , EP 2573629 , EP 2573933 and DE 19814096 all relate to multi-channel controllers.
  • an electronic control system including at least a first primary control microprocessor and a first back-up control microprocessor operable to control a device, the first primary control microprocessor and the first back-up microprocessor being located in a first control channel, a second control channel including at least one control microprocessor operable to control the device, and each of the first primary control microprocessors and the first back-up control microprocessors being arranged as an independent equivalent control channel.
  • FIG. 1 schematically illustrates a multi-channel controller 10.
  • the multi-channel controller 10 includes two primary control microprocessors A1, B1 and two back-up control microprocessors A2, B2.
  • Each of the primary control microprocessors A1, B1 shares a mount 12 with a corresponding local secondary control microprocessor A2, B2.
  • Each of the mounts 12 is considered a control channel.
  • Alternative embodiments could use four identical control microprocessors A1, B1, A2, B2 or could locate each of the four control microprocessors A1, B1, A2, B2 on separate mounts 12.
  • Each of the primary control microprocessors A1, B1 is connected to the other primary control microprocessor A1, B1 via a cross-channel data communications link and a channel-in-control signal 30.
  • the channel-in-control signal 30 informs the other primary control microprocessor A1, B1 of the operational status of the primary control microprocessor A1, B1 and the corresponding secondary control microprocessor A2, B2.
  • the channel-in-control signal 30 informs the other control microprocessors A1, B1, A2, B2 that the control microprocessor A1, B1 originating the channel-in-control signal is currently controlling the dual channel controlled device 20.
  • the operational status of any of the control microprocessors A1, B1, A2, B2 is referred to as the control microprocessor's health, and when the control microprocessor ceases function, the control microprocessor is referred to as being in a failure state, or unhealthy.
  • Each of the primary control microprocessors A1, B1 also includes a channel health signal 42, 44 (alternately referred to as a Channel Good Remote signal) connecting the primary control microprocessor A1, B1 to a remote secondary control microprocessor A2, B2, with the secondary control microprocessor B2 being remote to the primary control microprocessor A1 and the secondary control microprocessor A2 being remote to the primary control microprocessor B1.
  • a local channel health signal 60 (alternately referred to as a Channel Good Local signal) connects each of the primary control microprocessors A1, B1 with the corresponding local secondary control microprocessor A2, B2 and performs the same function as the remote channel health signals 42, 44.
  • Each of the two groupings of control microprocessors A1, B1, A2, B2 is connected to the controlled device 20 via a device control signal 70. It is understood that each of the signal lines 30, 42, 44, 60, 70 illustrated in Figure 1 can represent multiple physical signals connected to the control microprocessors A1, B1, A2, B2.
  • FIG. 2 illustrates an exemplary control channel with control microprocessors A1 and A2, a control microprocessor in-control logic block 320, and the latching Boolean gate 321 in a control input configuration 300.
  • Each of the control microprocessors A1, A2 has a control in-control request output 330, 331 that is passed to a standard latching Boolean gate 321 in each of the channels.
  • Each of the latching Boolean gates 321 generates outputs referred to as control microprocessor in-control outputs.
  • the control microprocessor in-control outputs serve as inputs to an OR gate 390.
  • the output of the OR gate 390 provides a general channel-in-control output 333 that is passed to the other channel (not illustrated).
  • Each control microprocessor in-control logic block 320 has a clear latch output 334, 336 that resets latching Boolean gate 321 output to false.
  • the control input configuration 300 also includes a control microprocessor in-control logic block 320 that combines a control microprocessor A1 in-control output 360 or a control microprocessor A2 in-control output 361 of the current channel and a general channel-in-control output 332 of the other channel (not illustrated) into a clear latch output 334, 336.
  • the control circuit corresponding to secondary control microprocessor A2 further includes an OR gate 350 that includes inputs of a local channel health signal 337 indicating the health of the primary control microprocessor A1 in the local channel A and a remote health signal 339 indicating the health of the primary control microprocessor B1 in the remote channel B.
  • the OR gate 350 then outputs a high signal indicating that the secondary control microprocessor A2 should not exert control when at least one of the two control microprocessor health inputs 337,339 indicates a healthy local/remote primary control microprocessor or the remote channel-in-control signal 332 indicates that one of the remote control microprocessors B1, B2 is in-control of the controlled device 20.
  • the control microprocessor in-control logic block 320 then uses a logic circuit (illustrated in Figure 3 ) to determine if the corresponding control microprocessor A1, A2 should exert control or should be prohibited from exerting control of the controlled device.
  • key signals from the switchover logic are wrapped-around to both control microprocessors A1, A2. These include but are not limited to the outputs of latching Boolean gate 321 (A1 control microprocessor in-control output 360 and A2 control microprocessor in-control output 361), the channel-in-control signal 333 and the remote channel-in-control 332. In addition, these wraparound signals provide fault detection capability.
  • FIG 3 illustrates the logic circuit of the control microprocessor in-control logic block 320 in greater detail.
  • the control microprocessor in-control logic block 320 includes an AND gate 354 and an OR gate 352.
  • the AND gate 354 accepts an input 332 corresponding to either the remote channel-in-control signal 332 for the control microprocessor in-control logic block 320 corresponding to the primary control microprocessor A1, or an input 370 corresponding to the output of the OR gate 350 (illustrated in Figure 2 ) for the back-up control microprocessor A2.
  • the AND gate 354 also accepts, and inverts, an in-control output 360, 361 as an input from the A1 or A2 latching Boolean gate 321, which disables the clear latch output when control microprocessor A1 or A2 is already in-control.
  • the AND gate 354 outputs a signal indicating that the corresponding control microprocessor A1, A2 is not allowed to take control of the controlled device 20 when input 370 indicates that a remote channel control microprocessor B1, B2 is in-control of the controlled device.
  • the remote channel control microprocessor B1, B2 cannot take control away from the local control microprocessor A1, A2.
  • the output of the AND gate 354 is passed to an OR gate 352 that additionally accepts an inverted input 362, 363 corresponding to a health of the control microprocessor A1 or A2.
  • the input 362, 363 can either originate from the control microprocessor A1, A2 or from independent health logic. If the input 362, 363 indicates that the control microprocessor A1, A2 is not healthy, the enable is set false and control is taken away from the control microprocessor A1, A2.
  • the OR gate combines the output of the AND gate 354 and the input 362 to generate a clear latch output that is capable of deactivating the A1 control microprocessor in-control or the A2 control microprocessor in-control outputs from logic block 321.
  • Figure 4 illustrates the exemplary control channel with control microprocessors A1 and A2, a control microprocessor in-control logic block 320, and the latching Boolean gate 321 in a control input configuration 300 with the addition of an OR gate 380 and an AND gate 391.
  • Each of the OR gate 380 and the AND gate 391 function together to create a hardware lock that locks out the primary control microprocessor A1 when the back-up control microprocessor A2 is in-control and locks out the back-up control microprocessor A2 when the primary control microprocessor A1 is in-control.
  • the OR gate 380 connects to an input of the control microprocessor in-control logic block 320 corresponding to the primary control microprocessor A1, and provides an OR operation on the control microprocessor A2 in-control output 361 input and the general channel-in-control output 332 of the other channel B, with one input to the logic block 382 being the output of the OR gate 380 operation.
  • the OR gate output 382 replaces the direct input of the general channel-in-control output 332 to the control microprocessor in-control logic block 320 corresponding to the primary control microprocessor A1.
  • the AND gate 391 receives a general channel-in-control signal 333 that is passed from the illustrated channel A to the other channel B as a first input, and an inverted control microprocessor A2 in-control output 361 as a second input.
  • the AND gate 391 outputs true on an AND gate output 392.
  • the AND gate output 392 provides an additional input to the OR gate 350, which in turn provides the input 370 of the control microprocessor in-control logic block 320 corresponding to the back-up control microprocessor A2.
  • the additional input of the AND gate 391 alters the OR gate 350 output to be high when at least one of the two control microprocessor health inputs indicates a healthy control microprocessor, or the remote channel-in-control signal 332 indicates that one of the remote control microprocessors B1, B2 is in-control of the controlled device 20 or the general channel-in-control signal 333 indicates that the illustrated channel is in-control and the control microprocessor A2 in-control output 361 of the current channel indicates that the back-up control microprocessor A2 is not in-control. That is, the primary control microprocessor A1, is in-control while the back-up control microprocessor A2 is not in-control.
  • the combined effect of the additional OR gate 380 and the additional AND gate 391 logic is to provide a hardware lockout that prevents the primary control microprocessor A1 of the illustrated channel from taking control when the back-up control microprocessor A2 of the illustrated channel is in-control and vice versa.
  • Figure 5 illustrates the exemplary control channel A of Figure 4 , with the further addition of a primary back-up control redundancy system that protects the channel-in-control circuit 300 from a single point failure that could inadvertently allow the back-up control microprocessor A2 to take control when it is not supposed to.
  • the illustrated control circuit 300 of Figure 5 includes the addition of a redundant control microprocessor A2 in-control output logic block 394 and a redundant control microprocessor A1 in-control output logic block 395.
  • Each of the redundant control microprocessor in-control logic blocks 394, 395 includes two redundant microprocessor in-control outputs 360a, 360b, 361a, 361b, with the outputs 360a, 360b, 361a, 361b being provided to a redundant channel-in-control logic block 396.
  • Each of the redundant logic blocks 394, 395, 396 imparts a redundancy on the logical operations, thereby ensuring that any single element failing within the logic circuitry does not lead to the back-up microprocessor A2 asserting control when the back-up microprocessor A2 is not supposed to take control.
  • Figure 6 illustrates a detailed example redundant control microprocessor A2, A1 in-control output logic block 394/395.
  • the example logic block 394/395 accepts a drive enabled signal from the corresponding microprocessor A1, A2 as an input 311/313.
  • the drive enabled signals 311/313 indicate as true when the corresponding microprocessor is enabled and is in-control. Similarly, the drive enabled signals 311/313 indicate as false, when the corresponding microprocessor is not enabled.
  • the logic block 394/395 also accepts the control microprocessor A1, A2 in-control output 360/361 of the corresponding microprocessor A1, A2 as an input.
  • the inputs 311/313, 360/361 are passed to a pair of redundantly arranged AND gates 510, 512 each of which outputs as true when both inputs indicate as true.
  • the resulting output of the logic block 394/395 is a pair of redundant in-control outputs 360a/361a, 360b/361b.
  • FIG. 7 illustrates the redundant channel-in-control logic block 396 of Figure 5 in greater detail.
  • the redundant channel-in-control logic block 396 includes a first OR gate 710 and a second OR gate 712, each of which outputs into an input of an AND gate 720.
  • the first OR gate 710 receives a first pair of redundant microprocessor in-control signals 360b, 361b from the redundant control microprocessor in-control logic blocks 394, 395.
  • the second OR gate receives a second pair of redundant microprocessor in-control signals 360a, 360b, from the redundant microprocessor in-control logic blocks 394, 395.
  • Each of the OR gates, 710, 712 outputs as true when either of the in-control outputs 360a/361a, 360b/361b acting as inputs to the OR gate 710, 712 indicates that the corresponding microprocessor A1, A2 is in-control.
  • the AND gate 720 then combines the outputs of each of the OR gates 710, 712 and outputs a channel-in-control signal 333, when both the OR gates 710, 712 output as true.
  • the redundant channel-in-control logic block 396 outputs a signal indicating that the illustrated channel is in-control even if one of the logic elements in the redundancy includes a fault such that one of the four signals (360a, 360b, 361a, 361b) is failed True. In this way, the back-up microprocessor A2 is prevented from taking control in a situation where the microprocessors A1, A2 are functioning properly and a fault has occurred within the microprocessor in-control signal logic.
  • some example embodiments include a resistive barrier between the microprocessors A1, A2, B1, B2 within a single channel.
  • the resistive barrier electrically isolates the channel-in-control circuitry of the back-up microprocessor A2, B2 from the primary microprocessors A1, B1 and prevents a fault in the back-up controller A2, B2 from propagating upwards into the primary controller A1, A2 of the same channel.
  • Figure 8 illustrates a state transition chart for a primary microprocessor A1 control assumption process 800 in either of the examples of Figures 4 and 5 where the controlled device is an H-bridge stepper motor.
  • the state transition chart describes a software process for determining if the primary microprocessor A1 in the local channel should take control, and implementing the assumption of control.
  • the microprocessor A1 can be in either one of two states: An A1 in-control state 810 or an A1 not in-control state 820. If the microprocessor A1 is in the A1 in-control state 810, then the microprocessor A1 will check the microprocessor A2 in-control wraparound signals 361a, 361b and set a fault flag if True. The next action depends on a set of prioritized conditions 812, 814, 816.
  • the highest priority condition 812 is when local channel primary control microprocessor A1 is healthier than a remote channel primary control microprocessor B1, then the software proceeds to a control action 830. If the cross-channel data link is not valid, the local channel primary control microprocessor A1 uses the last health value received from B1. If the highest priority condition is not met, then the software checks condition 814 as the second highest priority condition.
  • the second highest priority condition 814 is met when both channels A and B (See Figure 1 ) are in-control and the local channel is A. Although both channels A, B are not designed to take control simultaneously, it can happen due to unforeseen circumstances such as hardware faults. In this event, channel A is a preferred channel for breaking the conflict.
  • the second highest priority condition 814 is also met when the local primary microprocessor controller has a better health than the latest determined remote primary microprocessor controller health. If the cross-channel data link is not valid, A1 uses the last health value received from B1. When the second highest priority condition 814 is met, the software proceeds to control action 830. At control action 830, A1 evaluates 333, the channel-in-control output to the remote channel and checks for a True condition. If True, the software proceeds to Take/Keep Control Action 840. When neither of the higher priority conditions 812, 814 are met, the lowest priority condition 816 is met and the software moves to a give-up control action 850.
  • the highest priority condition, 822 is met when the remote channel B is in-control as indicated by an in-control from remote signal 332 or a flag from the remote channel B via a cross channel data link indicating the remote channel is in-control.
  • the highest priority condition 822 is also met if the local primary microprocessor A1 has had control within a set time period. In one example the set time period is 48 milliseconds.
  • the software proceeds to the give-up control action 850. If the highest priority condition 822 is not met, the software checks the second highest priority condition 824.
  • the second highest priority condition 824 is met when the back-up microprocessor A2 is in-control, and the remote channel B is not in-control.
  • the software proceeds to the give-up control action 850.
  • the software checks the third highest condition 826.
  • the third highest condition 826 is met when the local primary microprocessor controller has a better health than the latest determined remote primary microprocessor controller health. If the cross-channel data link is not valid, A1 uses the last health value received from B1.
  • this condition 826 is met, the software proceeds to a delay action 860, where further action is delayed for a set period of time. After the delay, the software proceeds to the second take/keep control action 840. In one example the delay time period is 10 microseconds.
  • the lowest priority condition 828 is met when none of the higher priority conditions 822, 824 and 826 are met.
  • the software proceeds to the give-up control action 850.
  • the software proceeds to set a wrap around in-control flag as false.
  • the software proceeds to set the primary microprocessor A1 as in-control in a set primary microprocessor as in-control action 890.
  • the software proceeds to disable the corresponding stepper motor H-bridge and set the primary controller as not in-control in the set primary microprocessor A1 as not in-control action 880.
  • A1 evaluates the channel-in-control output to the remote channel and checks for a False condition. If False, the software proceeds to set Channel-In-control Wraparound Fault Flag to True. The software then disables a corresponding stepper motor H-bridge and sets the primary controller A1 as not in-control in a set primary microprocessor A1 as not in-control action 880. If True, the software proceed to the take/keep control action 840.
  • Figure 9 illustrates a state transition chart 900 for a back-up microprocessor A1 control assumption process in either of the examples of Figures 4 and 5 where the controlled device is an H-bridge stepper motor.
  • the microprocessor software begins in one of two possible states: Either the microprocessor A2 is in a Back-up microprocessor in-control state 910 or the microprocessor A2 is in a back-up microprocessor not in-control state 920. From the back-up microprocessor in-control state 910, the software evaluates whether three possible conditions 914, 916, 918 are met, and evaluates how to proceed based on those possible conditions.
  • the highest priority condition 914 is met when either the back-up microprocessor A2 is not healthy enough to control or a local hardware wraparound fault exists within the local channel A such that a wraparound indicates that A2 is not in-control or should not be in-control.
  • the software proceeds to the give-up control action 940.
  • the highest priority condition 914 is not met, the software evaluates the second highest priority condition 916.
  • the second highest priority condition 916 is met when either both channels are in-control and the channel designation is A, or the remote channel is not in-control.
  • the software proceeds to a take/keep control action 930.
  • the lowest priority condition 918 is met when none of the higher priority conditions 914, 916 are met.
  • the software proceeds to the give-up control action 940.
  • the software begins in the back-up microprocessor is in-control state 920 there exist two possible conditions 922, 924.
  • the highest priority condition 922 is met when all the following are True: the remote channel B is not channel-in-control, the Remote Channel Good signal is False (the remote primary microprocessor control B1 in channel B is not healthy), the Local Channel Good signal is False (the local primary microprocessor control A1 in channel A is not healthy), there is no critical fault in the back-up microprocessor A2, the back-up microprocessor A2 is not disabled, the time since power-up is greater than a startup period and the back-up microprocessor has not been in-control for a set time period. In one example the startup period is two seconds.
  • the startup period allows the primary microprocessors A1, B1 a chance to take control before the back-up microprocessors A2, B2 do so. That is, on power-up, the preferred controls are the primary as opposed to the back-up microprocessor controls assuming the primary microprocessor controls are healthy.
  • the set time period is 48 milliseconds. The set time periods gives the remote back-up microprocessor control B2 an opportunity to take control. If the remote back-up microprocessor B2 does not take control within the set time period, the remote primary microprocessor B1 has the option to take back control if it is healthy enough to do so.
  • the highest priority condition 922 is met, the software proceeds to the take/keep control action 930.
  • the software runs the stepper motor H-bridges normally, controlled by the back-up microprocessor A2 in a run stepper motor H-bridges normally action 950.
  • the software disables the back-up microprocessor A2 H-bridge controls in a disable stepper motor H-bridges action 960.
  • control assumption processes 800, 900 are illustrated with regards to a primary Channel A, and a secondary channel B, it is understood that they could be adapted according to known methods to incorporate additional channels beyond two channels or to identify any channel as the channel-in-control channel. Furthermore, while the above described control assumption processes 800, 900 are described in terms of a software control scheme, it is understood that they could similarly be implemented using hardware logic.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Automation & Control Theory (AREA)
  • General Engineering & Computer Science (AREA)
  • Safety Devices In Control Systems (AREA)

Claims (12)

  1. Verfahren zum Steuern einer Übernahme der Steuerung einer Vorrichtung in einer Mehrfachkanalsteuerungsvorrichtung, das die folgenden Schritte umfasst:
    Vorsehen eines ersten Kanals mit einem ersten primären Mikroprozessor und einem ersten Back-up-Mikroprozessor und eines zweiten Kanals mit einem zweiten primären Mikroprozessor und einem zweiten Back-up-Mikroprozessor;
    Eintreten in einen Steuerungsprozess in einem von zwei möglichen Steuerungszuständen, wobei es sich bei den zwei möglichen Steuerungszuständen um einen Erster-primärer-Mikroprozessor-steuert-Zustand, in dem der erste primäre Mikroprozessor steuert, und einen Erster-primärer-Mikroprozessor-steuert-nicht-Zustand, bei dem der erste primäre Mikroprozessor nicht steuert, handelt;
    Bewerten einer Vielzahl von Bedingungen in Abhängigkeit davon, welcher der möglichen Steuerungszustände zutrifft, durch Bewerten eines ersten Bedingungssatzes, wenn sich der Steuerungsprozess in einem ersten Steuerungszustand befindet, und eines zweiten Bedingungssatzes, wenn sich der Steuerungsprozess in einem zweiten Steuerungszustand befindet;
    Eintreten in eine von einer Vielzahl von Aktionen auf Grundlage des Bewertens der Vielzahl von Bedingungen, wobei die Vielzahl von Aktionen eine Kanal-steuert-Ausgabesignal-falsch-Kontrolle, eine Übernehmen/Behalten-Steuerungsaktion und eine Aufgeben-Steuerungsaktion umfasst; und
    Durchführen einer Aktion als Reaktion auf das Eintreten in die eine von der Vielzahl von Aktionen, wobei die durchgeführte Aktion durch den eingetretenen Status definiert wird;
    wobei es sich bei der Kanal-steuert-Ausgabesignal-falsch-Kontrolle um eine Kontrolle handelt, bei welcher bestimmt wird, ob ein Ausgabesignal eines steuernden Kanals falsch ist;
    wobei es sich bei der Übernehmen/Behalten-Steuerungsaktion um eine Aktion handelt, bei welcher der erste primäre steuernde Mikroprozessor die Steuerung übernimmt/behält;
    wobei es sich bei der Aufgeben-Steuerungsaktion um eine Aktion handelt, bei welcher der erste primäre steuernde Mikroprozessor die Steuerung aufgibt, und
    wobei der zweite Bedingungssatz wenigstens vier Bedingungen enthält und dem Erster-primärer-Mikroprozessor-steuert-nicht-Zustand entspricht;
    eine erste Bedingung von den wenigstens vier Bedingungen erfüllt ist, wenn der zweite Kanal steuert, der zweite primäre Mikroprozessor steuert oder der erste primäre Mikroprozessor in einem festgesetzten Zeitraum gesteuert hat, und wobei die erste Bedingung von den wenigstens vier Bedingungen eine höchste Priorität einnimmt;
    eine zweite Bedingung von den wenigstens vier Bedingungen erfüllt ist, wenn der erste Back-up-Mikroprozessor steuert und der zweite Kanal nicht steuert, wobei die zweite Bedingung von den wenigstens vier Bedingungen eine zweithöchste Priorität einnimmt;
    eine dritte Bedingung von den wenigstens vier Bedingungen erfüllt ist, wenn der erste primäre Mikroprozessor eine bessere Gesundheit als eine zuletzt bestimmte Gesundheit des zweiten Kanals aufweist, wobei die dritte Bedingung von den wenigstens vier Bedingungen eine dritthöchste Priorität einnimmt;
    eine vierte Bedingung von den wenigstens vier Bedingungen erfüllt ist, wenn jede von der ersten, zweiten und dritten Bedingung von den wenigstens vier Bedingungen nicht erfüllt ist.
  2. Verfahren nach Anspruch 1, wobei
    der erste Bedingungssatz wenigstens drei Bedingungen enthält und dem Erster-primärer-Mikroprozessor-steuert-Zustand entspricht, und wobei es sich bei den drei Bedingungen um den Erster-Back-up-Mikroprozessor-steuert-, den Erster-und-Zweiter-Kanal-steuern- oder den Erster-primärer-Mikroprozessor-ist-gesünder-als-die-Zweite-primärer-Mikroprozessor-Steuerung- und alle anderen Zustände handelt;
    die Erster-Back-up-Mikroprozessor-steuert-Bedingung die Bedingung mit der höchsten Priorität ist;
    die Erster-und-zweiter-Kanal-steuern-Bedingung oder die Erster-primärer-Mikroprozessor-ist-gesünder-im-Vergleich-zu-dem-zweiten-primären-Mikroprozessor eine Bedingung mit mittlerer Priorität ist; und
    die Alle-anderen-Zustände-Bedingung eine Bedingung mit niedrigster Priorität ist.
  3. Verfahren nach Anspruch 2, wobei
    das Verfahren in die Kanal-steuert-Ausgabesignal-falsch-Kontrolle eintritt, wenn die Erster-Back-up-Mikroprozessor-steuert-Bedingung zutrifft oder sowohl der erste als auch der zweite Kanal steuern und der erste Kanal ein vordefinierter Kanal ist oder der erste primäre Mikroprozessor eine bessere Gesundheit als eine zuletzt bestimmte Zweiter-primärer-Mikroprozessor-Gesundheit aufweist; und
    das Verfahren in die Aufgeben-Steuerungsaktion eintritt, wenn die Alle-anderen-Zustände-Bedingung zutrifft, die Erster-Back-up-Mikroprozessor-steuert-Bedingung falsch ist und die Erster-und-Zweiter-Kanal-steuern-Bedingung falsch ist.
  4. Verfahren nach Anspruch 3, wobei das Verfahren in eine festgelegte Kanal-steuert-Fehlerflag-Aktion eintritt, wenn das Kanal-steuert-Signal anzeigt, dass die Kanal-steuert falsch ist, und wobei das Verfahren in die Übernehmen/Behalten-Steuerungsaktion eintritt, wenn das Kanal-steuert-Signal anzeigt, dass die Kanal-steuert zutrifft.
  5. Verfahren nach Anspruch 1, wobei das Verfahren in die Aufgeben-Steuerungsaktion eintritt, wenn die erste, zweite oder vierte Bedingung von den wenigstens vier Bedingungen erfüllt ist, und wobei das Verfahren eine Verzögerung erfährt und in die Übernehmen/Behalten-Steuerungsaktion eintritt, wenn die dritte von den wenigstens vier Bedingungen erfüllt ist.
  6. Verfahren nach Anspruch 1, wobei der Schritt des Durchführens einer Aktion als Reaktion auf das Eintreten in die eine von der Vielzahl von Aktionen ferner ein Festlegen eines Kanal-steuert-Ausgabesignal-Fehlerflags als falsch und ein Festlegen des ersten primären Mikroprozessors als steuert-nicht als Reaktion auf darauf, dass die Kanal-steuert-Ausgabesignal-falsch-Kontrolle positiv bewertet wird, umfasst.
  7. Verfahren nach Anspruch 1, wobei der Schritt des Durchführens einer Aktion als Reaktion auf das Eintreten in die eine von der Vielzahl von Aktionen ferner ein Festlegen des ersten primären Mikroprozessors als steuert als Reaktion auf das Eintreten in die Übernehmen/Behalten-Steuerungsaktion umfasst.
  8. Verfahren nach Anspruch 1, wobei der Schritt des Durchführens einer Aktion als Reaktion auf das Eintreten in die eine von der Vielzahl von Aktionen ferner ein Festlegen des ersten primären Mikroprozessors als steuert-nicht als Reaktion auf das Eintreten in die Aufgeben-Steuerungsaktion umfasst.
  9. Verfahren nach Anspruch 1, ferner umfassend den Schritt des Priorisierens jeder Bedingung innerhalb der Vielzahl von Bedingungen, sodass, wenn eine Bedingung einer höheren Priorität erfüllt ist, eine entsprechende Aktion vorgenommen wird, unabhängig davon, ob beliebige Bedingungen einer niedrigeren Bedingung erfüllt sind.
  10. Elektrisches Steuerungssystem, das zum Durchführen des Verfahrens nach Anspruch 1 ausgelegt ist, umfassend:
    wenigstens einen ersten primären Steuerungs-Mikroprozessor (A1, B1) und einen ersten Back-up-Steuerungs-Mikroprozessor (A2, B2), die zum Steuern einer Vorrichtung betreibbar sind, wobei der erste primäre Steuerungs-Mikroprozessor und der erste Back-up-Steuerungs-Mikroprozessor in einem ersten Steuerungskanal angeordnet sind;
    einen zweiten Steuerungskanal, der wenigstens einen Steuerungs-Mikroprozessor, welcher zum Steuern der Vorrichtung betreibbar ist, enthält;
    wobei der erste Steuerungskanal eine redundante Primärer-Steuerungs-Mikroprozessor-steuert-Logikschaltung, eine redundante Back-up-Steuerung-Mikroprozessor-steuert-Logikschaltung und eine redundante Kanal-steuert-Mikroprozessor-Schaltung enthält; und
    wobei ein redundanter Kanal-steuert-Mikroprozessor zum Ausgeben eines Kanal-steuert-Signals, wenn in der redundanten Primärer-Steuerungs-Mikroprozessor-steuert-Logikschaltung, der redundanten Back-up-Steuerungs-Mikroprozessor-steuert-Logikschaltung und der redundanten Kanal-steuert-Mikroprozessor-Schaltung wenigstens ein Fehler vorliegt, betreibbar ist.
  11. Elektrisches Steuerungssystem nach Anspruch 10, wobei der erste Steuerungskanal eine Hardware-Verriegelung enthält, die zum Verhindern, dass sich der Back-up-Steuerungs-Mikroprozessor bei der Steuerung durchsetzt, wenn der primäre Mikroprozessor die Vorrichtung steuert, betreibbar ist, und zum Verhindern, dass sich der primäre Steuerungs-Mikroprozessor bei der Steuerung durchsetzt, wenn der Back-up-Mikroprozessor die Vorrichtung steuert.
  12. Elektrisches Steuerungssystem nach Anspruch 10, wobei der erste primäre Steuerungs-Mikroprozessor (A1, B1) und der erste Back-up-Mikroprozessor (A2, B2) über eine Widerstandsschranke elektrisch voneinander isoliert sind.
EP14165781.7A 2013-05-06 2014-04-24 Mehrfachkanalsteuerungs-Umschaltlogik Active EP2801874B1 (de)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US13/887,561 US9772615B2 (en) 2013-05-06 2013-05-06 Multi-channel control switchover logic

Publications (2)

Publication Number Publication Date
EP2801874A1 EP2801874A1 (de) 2014-11-12
EP2801874B1 true EP2801874B1 (de) 2017-06-21

Family

ID=50828664

Family Applications (1)

Application Number Title Priority Date Filing Date
EP14165781.7A Active EP2801874B1 (de) 2013-05-06 2014-04-24 Mehrfachkanalsteuerungs-Umschaltlogik

Country Status (2)

Country Link
US (3) US9772615B2 (de)
EP (1) EP2801874B1 (de)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102014100970A1 (de) * 2014-01-28 2015-07-30 Pilz Gmbh & Co. Kg Verfahren und Vorrichtung zum sicheren Abschalten einer elektrischen Last
US9702937B2 (en) * 2015-02-17 2017-07-11 Lg Chem, Ltd. Contactor control system
US11720067B2 (en) * 2020-03-30 2023-08-08 General Electric Company Method for handling a simultaneous failure of all channels of a multi-channel engine controller for a gas turbine engine
CN115729274A (zh) * 2022-11-22 2023-03-03 中广核研究院有限公司 调速器和调速器的控制方法

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4029952A (en) 1973-11-06 1977-06-14 Westinghouse Electric Corporation Electric power plant having a multiple computer system for redundant control of turbine and steam generator operation
US3978659A (en) 1975-02-19 1976-09-07 Westinghouse Electric Corporation Bumpless transfer in shifting control command between the primary and backup control systems of a gas turbine power plant
US4521871A (en) 1982-04-12 1985-06-04 Allen-Bradley Company Programmable controller with back-up capability
US4562528A (en) 1982-10-06 1985-12-31 Mitsubishi Denki Kabushiki Kaisha Backup control apparatus
US4797884A (en) 1986-09-29 1989-01-10 Texas Instruments Incorporated Redundant device control unit
US5128943A (en) 1986-10-24 1992-07-07 United Technologies Corporation Independent backup mode transfer and mechanism for digital control computers
US4937777A (en) 1987-10-07 1990-06-26 Allen-Bradley Company, Inc. Programmable controller with multiple task processors
US4890284A (en) 1988-02-22 1989-12-26 United Technologies Corporation Backup control system (BUCS)
US5274554A (en) * 1991-02-01 1993-12-28 The Boeing Company Multiple-voting fault detection system for flight critical actuation control systems
US5192873A (en) 1991-02-26 1993-03-09 United Technologies Automotive, Inc. Fail-operational control system for vehicle loads
US5279107A (en) 1992-06-30 1994-01-18 United Technologies Corporation Fuel control system with fuel metering valve fault accommodation
DE19814096B4 (de) 1998-03-30 2007-07-19 Abb Patent Gmbh Verfahren zur Umschaltung redundant geschalteter, gleichartiger Baugruppen
US6440280B1 (en) * 2000-06-28 2002-08-27 Sola International, Inc. Multi-anode device and methods for sputter deposition
US8340793B2 (en) * 2009-10-09 2012-12-25 Hamilton Sundstrand Corporation Architecture using integrated backup control and protection hardware
US8536821B2 (en) 2011-09-22 2013-09-17 Hamilton Sundstrand Corporation Redundant interface for a stepper motor
US9483032B2 (en) 2011-09-22 2016-11-01 Hamilton Sundstrand Corporation Multi-channel protection logic
US9625894B2 (en) 2011-09-22 2017-04-18 Hamilton Sundstrand Corporation Multi-channel control switchover logic

Also Published As

Publication number Publication date
US20170351233A1 (en) 2017-12-07
US9772615B2 (en) 2017-09-26
EP2801874A1 (de) 2014-11-12
US10747186B2 (en) 2020-08-18
US20140330397A1 (en) 2014-11-06
US20190250574A1 (en) 2019-08-15

Similar Documents

Publication Publication Date Title
US10747186B2 (en) Multi-channel control switchover logic
EP2573636B1 (de) Umschaltlogik eines Mehrkanal-Steuerungssystems
US9952948B2 (en) Fault-tolerance pattern and switching protocol for multiple hot and cold standby redundancies
JP3827772B2 (ja) 分散型制御システムのための投票ノード
EP2413484B1 (de) Sicherheitssteuerungssystem
CN107531250A (zh) 车辆安全电子控制系统
US8340793B2 (en) Architecture using integrated backup control and protection hardware
CN107957692B (zh) 控制器冗余方法、装置及系统
US9690678B2 (en) Fault tolerant systems and method of using the same
CN106054852A (zh) 集成式故障沉默和故障运转系统中的可量容错的构造
CN107229534A (zh) 混合双重双工故障操作模式和对任意数量的故障的概述
JP2004259137A (ja) 電子制御装置
EP3626554A1 (de) Fahrzeugsteuerungssystem
CN110412862B (zh) 计算机联锁系统及其切换控制方法、设备、存储介质
CN115826393A (zh) 一种飞控系统的双余度管理方法及装置
US20120030524A1 (en) High reliability method of data processing, and controller unit
CN114690618A (zh) 飞控计算机备份切换方法、装置、设备及存储介质
CN112740121A (zh) 用于车辆的控制架构
US8831912B2 (en) Checking of functions of a control system having components
CN105573869B (zh) 基于i2c总线的系统控制器容错控制方法
KR101631631B1 (ko) 보호계전기의 고장진단 및 복구방법
US9787532B2 (en) Module, system and method of switching modules
US11609999B2 (en) Control system
US20170155546A1 (en) Duplex control device and duplex system
JP7471532B2 (ja) 制御装置

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20140424

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

R17P Request for examination filed (corrected)

Effective date: 20150508

RBV Designated contracting states (corrected)

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

17Q First examination report despatched

Effective date: 20150703

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

INTG Intention to grant announced

Effective date: 20170110

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 903472

Country of ref document: AT

Kind code of ref document: T

Effective date: 20170715

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602014010902

Country of ref document: DE

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20170621

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170922

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170921

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 903472

Country of ref document: AT

Kind code of ref document: T

Effective date: 20170621

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170921

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171021

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 5

Ref country code: DE

Ref legal event code: R097

Ref document number: 602014010902

Country of ref document: DE

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

26N No opposition filed

Effective date: 20180322

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20180430

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180430

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180430

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180430

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20140424

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MK

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20170621

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20170621

REG Reference to a national code

Ref country code: DE

Ref legal event code: R082

Ref document number: 602014010902

Country of ref document: DE

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230522

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20240320

Year of fee payment: 11

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20240320

Year of fee payment: 11

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20240320

Year of fee payment: 11